State-linked hackers targeted users of Sogou Input Method—one of the world’s most widely used tools for typing Chinese characters—by leveraging a zero-day vulnerability to silently drop a persistent backdoor on Windows systems, cybersecurity firm Gen Digital revealed in research published Thursday.

The attack allowed threat actors to execute arbitrary code with full user privileges after a target clicked a specially crafted link. Google Threat Intelligence attributes the campaign to UNC3569, a China-linked hacker-for-hire group active since at least 2021 that frequently targets government, education, technology, and finance sectors across East and Southeast Asia.

Tencent, the tech giant behind Sogou, released an automatic patch in April 2026. However, security researchers warn that the fundamental component enabling the breach remains unchanged inside the application.

The Attack Chain: From Link Click to Full Compromise

Sogou Input Method commands roughly 70% of the Chinese input market with over 455 million monthly active users across Windows, Android, and iOS, according to 2023 data from the University of Toronto’s Citizen Lab. While popular in China, international users account for a notable share, including over 3.3% of web visits coming from the United States.

Gen Digital discovered that the vulnerability resides in how the Windows version of Sogou processes custom inter-process links using the sgbiz: protocol handler.

When a user opens an sgbiz: link, Windows passes the request to an executable named biz_helper.exe. Gen Digital discovered that while the handler verified which application to run, it performed no validation or filtering on command-line arguments.

Hackers abused this gap by launching Sogou’s settings program (SGMyInput.exe) and instructing its skin store interface to load an attacker-controlled URL. The skin store automatically opened this link using Sogou’s internal, highly outdated copy of Chromium 80—a version released around March 2020.

Critical browser security protections inside this embedded browser had been manually disabled in the code:

• Disabled Sandbox: Rendered web pages were not isolated from the underlying operating system.
• Disabled Same-Origin Policy: Allowed malicious pages to read data across different site origins unrestricted.

As a result, visiting the malicious page was sufficient to achieve immediate code execution on the victim’s machine without requiring a secondary browser escape.

Tencent disputed the simplicity of the attack chain in statements quoted in the research, maintaining that the exploit sequence was “relatively complex” and would require social engineering to force a user to “actively authorize the browser’s pop-up prompt.”

Exploiting Legacy Chrome Vulnerabilities

The attacker’s web page contained an exploit for CVE-2021-38003, a high-severity flaw in Chrome’s V8 JavaScript engine that Google patched in October 2021 and CISA flagged as actively exploited later that year. Because Sogou’s embedded Chromium engine was never updated, the five-year-old vulnerability remained fully viable.

An analysis shows that out of 41 Chromium V8 vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, at least 32 were patched in Chrome releases published after the legacy build shipped inside Sogou.

Deployment of the GRAYRABBIT Backdoor

Once triggered, the exploit downloaded three files from an Alibaba Cloud server in Hong Kong to C:\Users\Public\Documents: a legitimate 7-Zip utility, an encrypted payload file (p), and a malicious DLL (7z.dll).

By placing the malicious DLL in the same directory, running 7-Zip forced the application to side-load the attacker’s code. To evade security sandboxes, the loader checked if the system had fewer than 50 running processes; if so, it generated an invalid decryption key to intentionally corrupt the payload.

After execution, the loader cleaned its footprint by transferring its content to an NTFS alternate data stream and marking itself for deletion.

The final payload delivered was GRAYRABBIT, a lightweight backdoor long utilized by UNC3569. The backdoor provides attackers with:

• Remote command shell access
• Bidirectional file transfer capabilities
• The ability to dynamically load additional modules from a command-and-control server

GRAYRABBIT established communications with mail.uaiubifas[.]top over port 443, using custom RC4-encrypted TCP traffic instead of standard TLS protocol.

Tencent’s Patch and Remaining Exposure

Gen Digital privately reported the flaw (now tracked as CVE-2026-51990) to Tencent on April 9, 2026. Tencent confirmed a fix was built and began rolling out version 16.3.0.3498 via automatic updates on April 21.

The patch restricts biz_helper.exe to accept only HTTPS URLs pointing to approved domains (sogou.com, qq.com, and woa.com).

However, Gen Digital noted that Tencent did not update or reconfigure the underlying browser engine. Sogou still relies on Chromium 80 with its native sandbox and web security features disabled, meaning the component remains fundamentally vulnerable if an attacker finds another path to supply arbitrary URLs.

Indicators of Compromise and Remediation

Users and network administrators are advised to verify that Sogou Input Method is updated past version 16.3.0.3498. Because public documentation does not clarify whether installing the patch terminates an active infection, security teams should scan endpoints for the following indicators:

• File Hashes (SHA-256):
  • 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 (Malicious DLL loader / 7z.dll)
  • 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e (Encrypted payload / p)
  • d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a (GRAYRABBIT backdoor / core.dll)
• Network Indicators:
  • Command & Control Domain: mail.uaiubifas[.]top (Port 443)
  • Exploit Host Domain: noht1ng[.]top
  • Staging IP Address: 8.218.50[.]207 (Alibaba Cloud Hong Kong)
• File System Artifacts:
  • Files written to C:\Users\Public\Documents\